San Francisco Network Passwords Spilled by Prosecutors

The tale of the rogue network admin at the city and county of San Francisco continues to roll on with the IT world watching incredulously.

In the latest update to the 15-day-long caper, prosecutors from District Attorney Kamala Harris' office submitted personal-access passwords and user names in an exhibit for court reference last week as evidence in their case against Terry Childs, the network architect and administrator who held the city's WLAN hostage for nine days in a professional disagreement with his manager.

A listing of about 150 user names and passwords of city officials for access into the system was submitted as evidence as part of the public record of the trial. After the passwords were discovered by the press earlier today, they were "redacted" from the record, DA spokeswoman Erica Derryck explained to me.

"The codes were always going to be used as evidence against Mr. Childs, and these [active] passwords have been changed as part of the process of undoing a situation that began with Mr. Childs' alleged criminal conduct," Derryck told me.

Resource Library:

It was not determined as to whether the usernames and passwords were active at the time they were first introduced as evidence to the court on July 23. The changeover to new passwords happened at approximately the same time.

Derryck said that a court date to set a preliminary hearing date for Childs will be held in late September -- most probably either Sept. 23 or 24.

The prosecutors claim that Childs' possession of these passwords proves he had too much power and posed an internal threat to the network, and thus, the city. Prosecutors also claimed that Childs could use the passwords to impersonate legitimate users and obtain illegal access to parts of the system where he was not authorized.

Childs, 43, was arrested on July 13 on four felony charges of tampering with the city's FiberWAN network. He changed several high-security passwords and refused to hand them over to department managers after claiming that his managers couldn't be trusted to run the system themselves. He also claimed they had been negligent about allowing viruses and malware into the system.

The nine-day standoff was broken July 23 after Childs divulged the network login codes to Mayor Gavin Newsom during a jailhouse meeting. Despite a hearing with a judge Thursday in an effort to lower his bond, Childs remains in jail in lieu of $5 million bail.

Childs, who resides in Pittsburg, Calif., is the chief designer of the system's FiberWAN, which contains about 60 percent of the city's sensitive human resources, payroll and other personal data.

Data from San Francisco's servers always have been able to be accessed; entry into the network switches and routers -- which control the flow and direction of data input/output -- is what was locked down by Childs.

The system ran on virtual autopilot for about 10 days while Department of Technology head Ron Vinson and others tried to regain access during the standoff. Vinson has yet to address the press about this ongoing issue.